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Abstract. We provide algorithms to count and enumerate representatives of 
the (right) ideal classes of an Eichler order in a quaternion algebra defined 
over a number field. We analyze the run time of these algorithms and consider 
several related problems, including the computation of two-sided ideal classes, 
isomorphism classes of orders, connecting ideals for orders, and ideal princi- 
palization. We conclude by giving the complete list of definite Eichler orders 
with class number at most 2. 



Since the very first calculations of Gauss for imaginary quadratic fields, the prob- 
lem of computing the class group of a number field F has seen broad interest. Due 
to the evident close association between the class number and regulator (embodied 
in the Dirichlet class number formula) , one often computes the class group and unit 
group in tandem as follows. 

Problem (ClassUnitGroup(Z^ )). Given the ring of integers Zp of a number field 
F, compute the class group C\Zp and unit group Up. 

This problem appears in general to be quite difficult. The best known (proba- 
bilistic) algorithm is due to Buchmann [7]: for a field F of degree n and absolute 
discriminant dp, it runs in time d 1 ^ 2 (log dp)°^ without any hypothesis [32), an d 
assuming the Generalized Riemann Hypothesis (GRH), it runs in expected time 
exp(0((log dp ) 1 / 2 (loglogiii?) 1 / 2 )) , where the implied O-constant depends on n. 

According to the Brauer-Siegel theorem, already the case of imaginary quadratic 
fields shows that the class group is often roughly as large as d 1 J 2 (\og dp)°^ . Sim- 
ilarly, for the case of real quadratic fields, a fundamental unit is conjectured to 
have height often as large as dp 12 (log dp) ^, so even to write down the output in 
a naive way requires exponential time (but see Remark |1.2|) . The problem of sim- 
ply computing the class number h(F) = #ClZp, or for that matter determining 
whether or not a given ideal of Zp is principal, appears in general to be no easier 
than solving Problem (ClassUnitGroup). 

In this article, we consider a noncommutative generalization of the above prob- 
lem. We refer to §1 for precise definitions and specification of the input and output. 

Problem (ClasslMumber(O)). Given an Eichler order O in a quaternion algebra 
over a number field F, compute the class number h(0). 

Problem (ClassSet(O)). Given an Eichler order O in a quaternion algebra over 
a number field F , compute a set of representatives for the set of invertible right 
O -ideal classes CIO. 
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The main results of this article are embodied in the following two theorems, 
which provide algorithms to solve these two problems depending on whether the 
order is definite or indefinite. 

Theorem A. 

(a) If O is indefinite, Problem (ClassNumber(O)) is deterministic polynomial- 
time reducible to Problem (ClassUnitGroup(Z^)). 

(b) If O is definite, then Problem (ClassNumber) is reducible in probabilistic 
time 

0(4 /2 log 4 d F + \og 2 Nd) 
to the factorization of the discriminant t) of O and 0(2 n ) instances of Prob- 

5/2 

lem (ClassUnitGroup) with fields having discriminant of size 0(dp ). 

Here and throughout the paper, unless otherwise noted the implied O-constants 
are absolute. 

Corollary. There exists a probabilistic polynomial- time algorithm to solve Problem 
(ClassNumber) over a fixed field F for indefinite orders and definite orders with 
factored discriminant. 

Theorem B. There exists an algorithm to solve Problem (ClassSet) for orders over 
a fixed field F. This algorithm runs in probabilistic polynomial time in the size of 
the output for indefinite orders and for definite orders with factored discriminant. 

It is important to note in Theorem B that we do not claim to be able to solve 
Problem (ClassSet) in probabilistic polynomial time in the size of the input, since 
the output is of exponential size and so even to write ideal representatives (in the 
usual way) requires exponential time. 

The algorithmic results embodied in Theorems A and B have many applications. 
Quaternion algebras are the noncommutative analogues of quadratic field extensions 
and so present an interesting and rewarding class to analyze. For example, the 
norm form on a quaternion order gives rise to quadratic modules of rank 3 and 
4 over 1p and computing ideal classes amounts to finding all isometry classes of 
forms in the same genus (see e.g. Alsina-Bayer [TJ Chapter 3] for the case F = 
Q). Ideal classes in quaternion orders are also intimately related to automorphic 
forms. In the simplest case where F = Q, the ideal classes of a maximal order in a 
quaternion algebra of discriminant p are in bijection with the set of supersingular 
elliptic curves in characteristic p. This correspondence has been exploited by Pizer 
[39] , Kohel [29], and others to explicitly compute spaces of modular forms over Q. 
By extension, one can compute with Hilbert modular forms over a totally real field 
F of even degree using these methods via the Jacquet-Langlands correspondence 
[14] . and the algorithms described below have already been used for this purpose 
[15] . Finally, this work allows explicit computations with Shimura curves, including 
the computation of CM points [17] , 

The outline of this article is as follows. In Section 1, we review background 
material from the theory of Eichler orders of quaternion algebras and their ideals. In 
Section 2, we introduce the algorithmic problems we will consider and discuss some 
of their interrelationships. In Section 3, we treat the problem of computing the set 
of two-sided ideal classes and connecting ideals for Eichler orders. In Section 4, we 
enumerate ideal classes in indefinite orders; we deduce Theorem A and its corollary 
in this case from Eichler's theorem of norms. In Section 5, we introduce the Eichler 
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mass formula which gives rise to an algorithm to count ideal classes in a definite 
quaternion order, completing the proof of Theorem A. In Section 6, we discuss ideal 
principalization in definite orders, rigorously analyzing the lattice search employed 
to find a generator, if it exists. In Section 7, we show how to enumerate ideal 
classes in definite orders, and use the Ramanujan property of the p-neighbors graph 
to prove Theorem B. Finally, in Section 8, we use our implementation of these 
algorithms in Magma [4] to compute the complete list of definite quaternion orders 
(over an arbitrary totally real field F) with class number at most 2 (Tables 18.31 - 
18. 4[) : counted up to a natural notion of equivalence, there are exactly 76 equivalence 
classes of definite Eichlcr orders with class number 1 and 217 with class number 2. 

We conclude this introduction by indicating two other results of significance 
found in the paper. In Section 5, we give a rigorous complexity analysis for com- 
puting the value (f(— 1) of the Dedekind zeta function of a totally real field F. We 
then prove a complexity result (Proposition [5TT2]) which serves as a partial converse 
to Theorem B: the problem of factoring integers a with O(logloga) prime factors 
is probabilistic polynomial time reducible to Problem (ClassNumber) over Q. In 
particular, if one can compute the class number of a definite rational quaternion 
order efficiently, then one can factor RSA moduli a — pq efficiently. 

The authors would like to thank the Magma group at the University of Sydney 
for their support, especially the assistance and advice of Steve Donnelly, as well as 
the reviewers for their very helpful comments and suggestions. The second author 
would like to thank Rcinicr Broker, Johannes Buchmann, Pete Clark, Henri Cohen, 
Tim Dokchitser, Claus Fieker, Eyal Goren, David Kohcl, and Damicn Stehlc for 
their valuable input. 

1. Quaternion algebras, orders, and ideals 

In this section, we introduce quaternion algebras and orders, and describe some 
of their basic properties; for further reading, see Reiner [41], Vigneras [44], and 
Brezezihski [5]. Throughout, let F be a number field of degree [F : Q] = n and 
absolute discriminant dp, an d let Zp be its ring of integers. 

Number rings. We follow the usual algorithmic conventions for number fields 
and finitely generated abelian groups (see Cohen [TT], Lenstra [32] )• In particular, 
following Lenstra [32] 2.5], to compute a finitely generated abelian group G means 
to specify a finite sequence di S Z>o and an isomorphism Q) i 'L/diL — > G, in 
turn specified by the images of the standard generators. Moreover, we represent 
a finitely generated torsion- free Zp-module J by a pseudobasis over Zp, writing 
I — 4 ciiji with at fractional ideals of Zp and ji € /. See Cohen [12l Chapter 1] 
for methods of computing with finitely generated modules over Dedekind domains 
using pseudobases. 

As in the introduction, we have the following basic problem. 

Problem 1.1 (ClassUnitGroup(Zp)). Given Zp, compute the class group C\Zp and 
unit group Zp. 

Remark 1.2. The representation of the output of Problem (ClassUnitGroup) is not 
unique, and therefore different algorithms may produce correct output but con- 
ceivably of arbitrarily large size. Indeed, we do not require that the outputted 
generators of the unit group Z* F to be represented in the usual way as a Z-linear 
combination of an integral basis for Zp, since in general these elements can be 
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of exponential size (as in the case of real quadratic fields). Instead, we allow the 
units to be represented as a straight-line program involving elements of Zf written 
in the usual way, for example as a (finite) product FJ it c (") of elements u G F* 
with c(u) G Z. In this way, one may be able to write down a set of generators of 
subexponential size. 

Proposition 1.3. There exists an algorithm to solve Problem (ClassUnitGroup(Zi?)) 

which runs in time dp 2 (log oIf) ^ >' assuming the generalized Riemann hypothesis 
(GRH) and a "smoothness condition" , this algorithm runs in time 

exp(0((logd F ) 1 / 2 (loglogd F ) 1 / 2 )), 

where the implied constant depends on n. 

The algorithm underlying Proposition 11.31 is due to Buchmann [7] (see therein 
for the "smoothness condition", which is known to hold for quadratic fields). See 
Lenstra [32l Theorem 5.5], Cohen-Diaz y Diaz-Olivier [13] . and Cohen [TlJ Algo- 
rithm 6.5.9] for further detail, and also Schoof [12] for a detailed analysis from the 
perspective of Arakelov geometry. 

Remark 1.4. A deterministic variant of the algorithm in Proposition 11.31 runs in 
time cT^/ 4 (logG?i?) 0< ' n \ due to the need to factor polynomials over finite fields. We 
allow probabilistic algorithms in what follows. 

Further, there exists an algorithm which, given the internal calculations involved 
in the class group computation of Proposition 11.31 determines whether or not an 
ideal a cZp is principal and, if so, outputs a generator (see Cohen [TTJ Algorithm 
6.5.10]). No estimates on the running time of this algorithm have been proven, but 
it is reasonable to expect that they are no worse than the time for the class group 
computation itself. (See also Remark KOI below for an alternative approach, which 
gives a principalization algorithm which runs in deterministic polynomial time over 
a fixed totally real field F.) 

Quaternion algebras. A quaternion algebra B over F is a central simple algebra 
of dimension 4 over F, or equivalently an _F-algebra with generators a, (3 G B such 
that 

(1.5) a 2 =a, (3 2 = b, a(3 = -/3a 

with a, b € F*. Such an algebra is denoted B = ^-j^J and is specified in bits by 

the elements a, b £ F* , and an element 7 = x + yet + z(3 + waft G B is specified by 
the elements x, y, z,w G F. 

Let B be a quaternion algebra over F. Then B has a unique (anti-)involution 
— : B — * B called conjugation such that 7 + 7, 77 G F for all 7 G B. We define 
the reduced trace and reduced norm of 7 to be trd(7) =7 + 7 and nrd(7) = 77, 

respectively. For B = as m (|1 -5|) we have 

(1.6) 7 = x — (ya + zf3 + waft), trd(7) = 2x, nrd(7) = x 2 — ay 2 — bz 2 + abw 2 . 

Let K be & field containing F. Then Bk — B®p if is a quaternion algebra over 
K, and we say K splits B if Bk — M 2 (K). If [K : F] = 2, then K splits B if and 
only if there exists an i^-embedding K B. 
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Now let v be a place of F, and let F v denote the completion of F at v. We say 
B is split at v if F v splits B, and otherwise we say that B is ramified at v. The 
set of ramified places of B is of even (finite) cardinality and uniquely characterizes 
B up to _F-algebra isomorphism. We define the discriminant S = disc(_B) of B to 
be the ideal of Tp given by the product of all finite ramified places of B. One can 
compute the discriminant of B in probabilistic polynomial time given an algorithm 
for integer factorization [51j . 

We say that B is totally definite if F is totally real and every real infinite place 
of F is ramified in B; otherwise, we say that B is indefinite or that B satisfies the 
Eichler condition. 

Quaternion orders. A Tip-lattice I C B is a finitely generated Z^-submodule of 
B with IF = B. An order C B is a Zi?-lattice which is also a subring of B (hence 
1 e O), and an order is maximal if it is not properly contained in another order. 
We represent a Z^-lattice by a pseudobasis, as above. The problem of computing a 
maximal order is probabilistic polynomial-time equivalent to integer factorization 

PI- 

We will use the general principle throughout that Zp -lattices are determined by 
their localizations. For every prime ideal p of Tp, let Tp tP denote the completion 
of Tp at p. For a Zir-lattice /, we abbreviate I p = I <g>z F Tp$. Then for two 
Z^-lattices I,JcB, we have I — J if and only if I p = J p for all primes p. 

For 71, . . . ,74 6 B, we let disc(7i, . . . , 74) = det(trd(7i7j))ij = i i ... i 4. For an order 
C B, the ideal of Tp generated by the set 

{disc(7i, . . . ,74) : 7* € 0} 

is a square, and we define the (reduced) discriminant t> = disc(0) of to be the 
square root of this ideal. If = ® i 0^7^ then we compute the discriminant as 

d 2 = (ai • ■ ■ o 4 ) 2 disc(7i, . . . ,74). 

An order is maximal if and only if t) = D. 

An Eichler order is the intersection of two maximal orders, and it is this class 
of orders which we will study throughout. The level of an Eichler order is the 
ideal 01 C Tp satisfying = £>01; the level 01 is coprime to the discriminant S of 
B. Alternatively, given a maximal order C B, an ideal 01 coprime to 2) and an 
embedding tg? : O A^Z^gn) where Z^sji denotes the completion of Z^ at 0T, 
an Eichler order of level 01 is given by 

(1.7) Co(01) = {7 € : ^(7) is upper triangular modulo 01} , 

and all Eichler orders arise in this way up to conjugation. In particular |41[ Theorem 
39.14], an order O is hereditary (all one-sided ideals of O are projective) if and only 
if O is an Eichler order with squarefree level. 

We can compute an explicit pseudobasis for an Eichler order Oq (01) from the 
description (|1.7|) as follows. First, we compute a maximal order O C B as above. 
Next, for each prime power p e || 01, we compute an embedding t p : O t — > A^Z^p); 
this can be accomplished in probabilistic polynomial time |51j . From t p , one easily 
computes Oo(p e ) using linear algebra. Then Oo(01) = C\ p ^\\n ^o(p e ), and this 
intersection can be computed as Zi?-lattices. 

Two orders 0,0' are conjugate (also isomorphic or of the same type) if there 
exists v S B* such that O' = v~ 1 Ov, and we write = 0'. 
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Proposition 1.8 ([44, Corollaire III. 5. 5]). The number of isomorphism classes of 
Eichler orders O C B of level 91 is finite. 

Quaternion ideals. We define the reduced norm nrd(7) of a Z^-lattice 7 to be 
the fractional ideal of If generated by the set {nrd(7) : 7 G /}. 

Let 7, J be Z^-lattices in B. We define the product 7 J to be the Z^-submodulc 
of B generated by the set {a(3 : a £ I, (3 £ J}; we have nrd(7J) D nrd(J) nrd(J). 
We define the left colon 

(7 : J) L = {7 £ B : 7 J C 7} 

and similarly the right colon 

(7 :J) R = { 1 £B:J 1 £ I}. 

The colons (7 : J)l> (7 '■ J)r and the product I J are Z^-lattices. If I = J, then 
(7 : I)l = Ol(I) (resp. (7 : I)r = Or{I)) also has the structure of a ring, called the 
left (resp. right) order of the Zj?-lattice 7. One can compute the left and right colon 
in deterministic polynomial time using the Hermite normal form for Z^-lattices (see 
Friedrichs [22j §2.3]). 

Let O C B be an order. A right fractional O-ideal is a Z^-lattice I such that 
®r(I) = O. In a similar fashion, we may define left fractional ideals; however, 
conjugation 

I h-> I = {7 : 7 £ 1} 

gives a bijection between the sets of right and left fractional O-ideals, so when 
dealing with one-sided fractional ideals it suffices to work with right fractional 
ideals. If I (resp. J) is a right fractional O-ideal then Or{(I : J)r) C O (resp. 
Ol((I : J)r) C O). Note that any Zflattice I is by definition a right fractional 
0j?(/)-ideal (and left fractional 0i(/)-ideal). 

A Z^ -lattice I is integral if / C Or(I), or equivalently if I is a right ideal of 
Or(I) in the usual sense; for any Z^-lattice I, there exists a nonzero d £ "Lp such 
that dl is integral. 

A Z^-lattice 7 is a left fractional Oi(7)-ideal and a right fractional Ofl(7)-ideal, 
and we say that 7 is a fractional Ol(7), C/j(7)-ideal; if Ol(7) = Or (I) = O we say 
that 7 is a two-sided O-ideal. 

A right fractional O-ideal is left invertible if there exists a left fractional O-ideal 
7 _1 such that 7 _1 7 = O. If 7 is left invertible, then necessarily 

r 1 = (O :7) L =7/nrd(7). 

Equivalently, 7 is left invertible if and only if 7 is locally principal, i.e., for each 
(finite) prime ideal p of Zp, the ideal 7 p is a principal right O p -ideal. It follows 
that if 7 is an O', O-ideal then 7 is left invertible if and only if 7 is right invertible 
(analogously defined), and so we simply say 7 is invertible, and then 77 _1 = O' and 
7 _1 = (O' : I)r, If 7 is an invertible right fractional O-ideal and J is an invertible 
left fractional O-ideal then (7J) _1 = J _1 7 _1 and nrd(7J) = nrd(7) nrd( J), and 
moreover 

O l (7J) = O l (7) and O r {IJ) = R (J). 

We note that for an order O, every right fractional O-ideal 7 is invertible if and 
only if O is hereditary. 

Let 7, J be invertible right fractional ideals. Then (7 : J)r is a fractional 
Or(J), Ofl(7)-ideal and similarly (7 : J)l is a fractional Ol(7), Ol( J)-ideal, and 
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so we will also call (7 : J)l (resp. (I : J)r) the left (resp. right) colon fractional 
ideal. 

Let I, J be invertible right fractional O-ideals. We say that I and J are in the 
same right ideal class, and write I ~ J, if there exists an a G B* such that I — aJ. 
We have I ~ J if and only if 7 and J are isomorphic as right O-modules, and so 
in this case we also say that I and J are isomorphic. It is clear that ~ defines 
an equivalence relation on the set of right fractional ideals of O; we write [I] for 
the ideal class of I. Since B is noncommutative, the ideal class [I J] of two right 
fractional O-ideals I, J is in general not determined by the ideal classes [I] and 
[J], so the set of right ideal classes may not form a group. We denote the set of 
invertible right O-ideal classes by CIO. 

The set of invertible two-sided fractional O-ideals forms a group under multi- 
plication, and the quotient of this group by the (normal) subgroup of principal 
two-sided fractional O-ideals is called the two-sided ideal class group of O; two 
invertible two-sided fractional O-ideals /, J are in the same ideal class if they are 
equal in the two-sided ideal class group of O, or equivalently if / J -1 is a principal 
two-sided fractional O-ideal. 

An order O is connected to an order O' if there exists an invertible fractional 
O, O'-ideal I, the connecting ideal. The relation of being connected is an equivalence 
relation, and two Eichler orders O, O' are connected if and only if they have the 
same level 9L 

Proposition 1.9 ([44, Theoreme III.5.4], [HJ §26]). The set CIO is finite and 
f/= CI O is independent of the choice of Eichler order O of a given level. 

We let h(O) = # CIO denote the class number of the Eichler order O. 

2. Algorithmic problems 

In the remainder of this article, we will be concerned with a constellation of 
interrelated algorithmic problems which we now introduce. 

Problem 2.1 (ClassNumber(O)). Given an Eichler order O, compute the class 
number h(0). 

Problem 2.2 (ClassSet(O)). Given an Eichler order O, compute a set of repre- 
sentatives for the set of invertible right O-ideal classes CIO. 

Obviously, a solution to Problem 12.21 (ClassSet) gives a solution to Problem 12.11 
(ClasslMumber), but as we will see, this reduction is not the most efficient approach. 

Given a set of representatives for CIO and a right fractional ideal I of O, we 
may also like to determine its class [I] £ CIO and so we are led to the following 
problems. 

Problem 2.3 (lslsomorphic(7, J)). Given two invertible right fractional ideals I, J 
of an Eichler order O, determine if I ~ J; and, if so, compute £ G B* such that 
I = tJ. 

Problem 2.4 (IsPrincipal(J)). Given an invertible right fractional ideal I of an 
Eichler order O, determine if I is principal; and, if so, compute a generator £ of I. 

In fact, these two problems are computationally equivalent. 

Lemma 2.5. Problem (Islsomorphic) is equivalent to Problem (IsPrincipal). 
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Proof. Let /, J be invertible right fractional O-ideals. Then I = £ J for £ e _B* 
if and only if the left colon ideal (I : J)l is generated by £ as a right fractional 
Ol{ J)-ideal. Therefore, I ~ J if and only if (/ : J)^ is a principal fractional right 
C L (J)-ideal. □ 

We also have the corresponding problem for two-sided ideals. 

Problem 2.6 (TwoSidedClassSet(O)). Given an Eichler order O, compute a set of 
representatives for the two-sided invertible ideal classes of O. 

Finally, we consider algorithmic problems for orders. 

Problem 2.7 (lsConjugate(0, O')). Given two Eichler orders 0,0' of B, deter- 
mine if O = O' ; and, if so, compute v G B* such that vOv~ x = O' . 

Problem 2.8 (ConjClassSet(O)). Given an Eichler order O of level $1, compute a 
set of representatives for the conjugacy classes of Eichler orders of level *Tl. 

Problem 2.9 (Connectingldeal(0, 0')). Given Eichler orders 0,0', compute a 
connecting ideal I with Or(I) = O and Ol{I) = O' . 

We conclude by relating Problem 12.21 (ClassSet) to Problem l2.8l (ConiClassSetV 

Proposition 2.10. LetOi be representatives of the isomorphism classes of Eichler 
orders of level *Tl. For each i, let Ii be a connecting fractional Oi,0-ideal and let 
Jij be representatives of the two-sided invertible fractional Oi-ideal classes. 
Then the set {Ji,jh}i,j is a complete set of representatives of CIO. 

Proof. Let / be an invertible right fractional O-ideal. Then Ol(I) = Oi for a 
uniquely determined i, so Ol(I) = v~ Y OiV for some v 6 B* . But then Ii = vKl 
where K = v^IJ^ 1 is a two-sided invertible fractional 0L(/)-ideal, and so I ~ 
Kli ~ Jijh for some j, again uniquely determined. □ 

It follows directly from Proposition 12.101 that if one can solve Problem 12.81 
(ConjClassSet) then one can solve Problcm l2.2l (ClassSet). given algorithms to solve 
Problcm l2.9l (ConnectingldeaO and Problem l2.6l (TwoSidedClassSet). We will discuss 
this further in §§3-4. 

Conversely, if one can solve Problem 12.21 (ClassSet) then one can solve Problem 
12.81 (ConjClassSet) given an algorithm to solve Problem 12.71 (IsConiugate): indeed, 
by Proposition 12.101 one obtains a set of representatives for the conjugacy classes 
of orders by computing Ol(I) for [I] S CI O. The difficulty of solving Problem 12.71 
(IsConjugate) is discussed in §4 and §6. 

3. Two-sided ideal classes and connecting ideals 

In this section, we discuss Problem 12.61 (TwoSidedClassSet) and Problem 12.91 
(Connectingldeal). 

Two-sided ideal classes. Let O C B be an Eichler order of discriminant i) and 
level 01. The two-sided ideals of O admit a local description, as follows. Let F p 
denote the completion of F at p, let 1>F,p denote its ring of integers, and let tt be a 
uniformizer for Zp jP . 
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First, suppose that B p — B®f F p is a division ring. Then the discrete valuation 
v of Zf,p extends to Bp, and Op is the unique maximal order of Bp. The fractional 
right O p -ideals form a cyclic group generated by the principal ideal 

rad(O p ) = { 7 £O p : «( 7 ) > 0}; 

in particular, they are all two-sided [12 Theorem 13.2] and invertible. We have 
rad(Op) = [Op, Op], where [O p ,O p ] denotes the two-sided Op-ideal generated by 
the set {-fS - 5-f : 7, 5 £ O p } (see Reiner [4TJ Theorem 14.5]). 
Next, suppose that B p = h'hiFp) and that 

(3.1) °^{^p l F :y u ^ 

so that p e || 01. Then the principal (equivalently, invertible) two-sided fractional 
ideals of O p form an abelian group generated by 7rO p and 

tyo p = [o p ,o 9 ] 

(see the proof given by Eichler [181 Satz 5] for e = 1, which applies mutatis mutandis 
for all e). Since [O p ,O p ] 2 = 7r e O p , this group is cyclic if and only if e is odd or 
e = 0. 

In particular, it follows from the preceding discussion that [O, O] is an invertible 
two-sided O-ideal, and we have the following description of the group of two-sided 
ideals. 

Lemma 3.2. The set of invertible fractional two-sided O-ideals forms an abelian 
group generated by the set 

{pO : p C Z F } U {[O, O] + p e O : p e || d}. 

Proof. The group of invertible two-sided fractional O-ideals is abelian since it is so 
locally by the above. 

Let / be an invertible two-sided fractional O-ideal. Clearing denominators, 
we may assume I is integral. Let M be an invertible maximal two-sided O- 
ideal containing /. Then by maximality, there exists a unique prime ideal p 
of %f such that M q = O q for all q 7^ p. Thus by the preceding discussion, 
M = pO or M = [0,0] + p e O with p e || 0. Now JM -1 is again integral and 
nrd(/ilf _1 ) = nrd(/)/ nrd(Af) | nrd(J), so the result follows by induction. □ 

For an alternative proof of Lemma 13.21 when O is hereditary, see Vigneras [44l 
Theoreme 1.4.5]. 

Proposition 3.3. The group of invertible, two-sided fractional ideal classes of O 
is a finite abelian group generated by the classes of 

{aO : [a] £ CL(Z P )} U {[O, O] + p e O : p e || 0}. 

If B is indefinite, one can omit all generators [0,0] + p e O for which e is even. 

Proof. Since the principal two-sided fractional O-ideals form a subgroup, the first 
statement follows from the preceding lemma. For the second statement, we skip 
ahead and apply Proposition ^. II if e is even, the ideals p e / 2 and [0, 0]+p e O have 
the same reduced norm p e , so they are in the same ideal class if B is indefinite. □ 
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Corollary 3.4. Problem (TwoSidedClassSet(0)) for an Eichler order with fac- 
tored discriminant U is polynomial-time reducible to Problem (ClassUnitGroup)(ZF) 
and OihifLp) 2 N5 2 ) instances of Problem (Islsomorphic). 

Proof. Since ([0,0] + p e O) 2 = p e O (as this is true locally), there are at most 
2 UJ ^'h(7 1 p) two-sided ideal classes, where denotes the number of prime factors 
of 0. We have trivially 2"^°' < NT), and the result follows. □ 

Eichler orders and connecting ideals. We now exhibit an algorithm to test if 
an order is an Eichler order. 

Algorithm 3.5. Let C B be an order of discriminant (3 = 2)01 with 01 prime to 
the discriminant D of B, and let i<j\ : M2{Fsj\). This algorithm determines if 
is an Eichler order, and if so, returns an element v £ B such that ^(v^ 1 Ov) = 
O {% (as in ifLTjl). 

1. Compute fi £ B such that L<si(fj, O fi) C MbfZ.pg,). Let i' m = /iifn/i -1 . 

2. Factor the ideal 01, and for each prime power p e || 01: 

a. From the restriction i' : M2(F p ) of l'^, use linear algebra over 
Zf,p to test if there is a common eigenvector (x p ,z p ) £ (Zf/P € ) 2 for 
the elements of a Zf\p-module basis of O p . If not, return false. 

b. Compute y p ,w p such that N p = ( Xp Vv ) £ GL 2 (Z F /p e ). 

\z p w p J 

3. By the Chinese remainder theorem, compute v £ B such that i p {y p ) = N p 
(mod p e ). Return true and [iv. 

Proof of correctness. We refer to work of the second author |51j for more on Step 
1. 

For the rest of the algorithm, we note that the property of being an Eichler order 
is local: in particular, we see that a local order O p — 0®z f "Lf,p with disc(O p ) = p e 
is Eichler if and only if there exists such a common eigenvector modulo p e of all 
7 £ O p . Conjugation by the matrix N p as in Step 2b then shows that (1, 0) is an 
eigenvector modulo all such p e , as desired. □ 

Now let 0, O' be two Eichler orders in B having the same level 01. We consider 
Problcm l2.9l (ConnectingldeaO and compute an invertible 0',0-ideal I. 

For any prime p { 01, by maximality the Z^p-lattice (O r O) p is a O p , O p -ideal. 
So suppose p | 01. Since any two Eichler orders of the same level are locally 
conjugate, there exists v p £ B p such that O p = v p O p v p . The map I i— * v p I 
gives an equivalence between the category of fractional two-sided O p -ideals and the 
category of fractional OL O p -ideals. 

From this analysis, we arrive at the following algorithm. 

Algorithm 3.6. Let O.O' C B be Eichler orders of level 01. This algorithm 
computes an invertible fractional 0',0-ideal. 

1. Let u, v' be the output of Algorithm 13 . 51 for the orders 0, 0' and a common 
choice of splitting L<y\. 

2. Compute a nonzero d £ TLp such that fi := dv~ x v' £ 0' as follows: write 
v~ x v' in terms of a Zi?-pseudobasis for 0', and compute a nonzero d as the 
least common multiple of the denominators of the coefficients of v~ x v' . 

3. Compute nrd(/i)Z^ = na with a prime to 01, and return the Z^-lattice 
/ := fiO + nO'O. 
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Proof of correctness. In Step 1, we obtain from Algorithm 13.51 that for all p | 91 we 
have O p — VpO a {W)pVp l and O p = fpOoO^p^p -1 - It is clear that Step 2 gives the 
correct output, and hence O p = (ipOpfip 1 for all such p. 

To conclude, we need to show that Ol(I) = O' and Or(I) = O. It suffices to 
check this locally. For any prime p f 9t, we have fi p e 0' p = rtpO p , so I p = (O'O)p, 
which is a fractional OL, Op-ideal by the above. For p | 01, we have 

vipO'p = O'pWp = Op7Ip/ip C Op/ip = MpCp 

since p p £ O p . Hence I 9 = ^ p O p and the result follows by the equivalence above, 
since O p is a two-sided Op-ideal so Ip is a fractional Op, O p -ideal. □ 

Corollary 3.7. Problem (IsConjugate) for two Eichler orders with factored discrim- 
inant D is probabilistic polynomial-time reducible to Problems (TwoSidedClassSet) 
and (Islsomorphic). 

Proof. By Proposition 12.101 if / is an invertible right O-ideal, then Ol(I) is con- 
jugate to O if and only if / is equivalent to an invertible two-sided O-ideal J: in 
fact, if J = vl then O = vO'v . Thus, to check whether two given Eichler or- 
ders 0,0' (of the same level) are conjugate, it suffices to construct a connecting 
ideal / as in Algorithm 13. 61 — which can be done in probabilistic polynomial time — 
and one can accordingly check for an isomorphism given a solution to Problem 
(TwoSidedClassSet) and (Islsomorphic). □ 

4. Ideal classes in indefinite orders 

In this section, we discuss the difficulty of solving Problems 12.11 (ClassNumber) 
and 12.21 (ClassSet) in the indefinite case. 

Let B be an indefinite quaternion algebra and let O C B be an Eichler order. 
Let Sao denote the set of ramified (real) infinite places of B and let Clg^ %p denote 
the ray class group of If with modulus Soo. The quotient group Cls^ 7Lp / C\7Lp 
is an elementary 2-group isomorphic to Hp s ^ fZp 2 where 

Zp iS=o = {u e Z* F : v(u) > for all v £ Sao}- 

Proposition 4.1 (Eichler's theorem Corollary 34.21], gH Theoreme III. 5. 7]). 
If B is indefinite and O C B is an Eichler order, then the reduced norm map 

nrd : CIO -> Cl s=o Z F 

is a bijection (of sets). 

We have the following immediate corollary, which proves Theorem A in the 
indefinite case; we restate it here for convenience. 

Corollary 4.2. If B is indefinite, then Problem (ClassNumber(O)) is reducible in 
deterministic polynomial time to Problem (ClassUnitGroup(ZF))- 

In other words, there exists a deterministic algorithm to solve Problem 12.11 
(ClassNumber) which, given an algorithm to solve Problem (ClassUnitGroup), runs 
in polynomial time in its output size. (See Remark 1 1.21 ) 

Proof. We compute h(0) = #(Z FSgg /Zf)h(Z F ). Given the class group C1Z F , 
its order h(Zp) = ff=C\Z,F can be computed in polynomial time. Similarly, given 
generators for the unit group Hp, one can compute in deterministic polynomial 



12 



MARKUS KIRSCHMER AND JOHN VOIGHT 



time (in the size of their representation) their signs for each real place v, and using 
linear algebra over F2 determine the 2-rank of the group 1? F g^/Zp 2 . □ 

It follows immediately from Corollary 14.21 that for Eichler orders over a fixed 
number field F, Problem 12.11 (ClassNumber) can be solved in time 0(1), which 
proves the corollary to Theorem A. 

Next, we discuss Theorem B in the indefinite case. First, we exhibit an auxiliary 
algorithm for computing ideals with given norm, which works for both definite and 
indefinite quaternion orders. 

Algorithm 4.3. Let O be an Eichler order and let o C Zp be an ideal which 
is coprime to D. This algorithm returns an invertible right O-ideal / such that 
nrd(-T) = a. 

1. Factor a into prime ideals. 

2. For each p e || a, find a zero of the quadratic form nrd(a p ) = (mod p), 
and choose a random lift of a p modulo p 2 so that nrd(a p ) is a uniformizcr 
at p. Let (3p — a^. 

3. Use the Chinese remainder theorem to find (3 6 If such that j3 = f3 v 
(mod p e ) for all p e || a. Return the right O-ideal [30 + aO. 

From Eichler's theorem (Proposition 14. lj) . we then have the following straight- 
forward algorithm. 

Algorithm 4.4. Let O be an indefinite Eichler order. This algorithm solves Prob- 
lem CL2] (ClassSet). 

1. For each a in a set of representatives for Clg^ Z^/2 Cls^ Zp, compute using 
Algorithm 14.31 an ideal I a of norm o. 

2. Return the set {c/ a } 0jC , with c 2 in a set of representatives of 2 Cls^ Zp- 

Proposition 4.5. Problem 12.21 (ClassSet) for indefinite orders over a fixed field F 
can be solved in probabilistic polynomial time. 

Proof. One can solve Problem (ClassUnitGroup) for the field F in constant time 
and one can further factor the generating ideals o which are given as output. The 
statement follows by noting that Step 2 of Algorithm 14.31 can be performed in 
probabilistic polynomial time |51j by extracting square roots modulo p. □ 

Proposition 14.51 thus proves the indefinite case of Theorem B. 

Remark 4.6. In practice, in Algorithm 14.41 one may wish to find representatives of 
CIO with the smallest norm possible; one can then simply find small representa- 
tives a for each ideal class of CL?^ Zp (using the LLL algorithm [33], part of the 
algorithms used in the algorithm described in Proposition ll.3l) and then repeat Step 
1 for each such ideal a. 

To solve Problem l2.8l fConiClassSet) for Eichler orders, we amend Algorithm 14.41 
as follows. 

Algorithm 4.7. Let O C B be an indefinite Eichler order of discriminant 0. This 
algorithm solves Problem 12.81 (ConjClassSet). 

1. Let H be the subgroup of Cls^ If generated by 2ClZi? and [p e ] for all 
p e || with e odd. 
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2. For each a in a set of representatives for Cls^ Zf/H, let a € O be such 
that nrd(a) is a uniformizer of a and let I a ■= aO + aO. 

3. Return the set {0L(J a )} o . 

Proof of correctness. By Proposition ^. 31 the image of the reduced norm of the set 
of two-sided ideal classes maps is exactly H . It then follows from Proposition ^. 101 
that one recovers all conjugacy classes of Eichler orders of level 91 as Ol(I ) for the 
right O-ideals I a with a as in Step 2. □ 

Finally, we are left with Problem 12.41 (IsPrincipal). Let / be a right fractional 
O-ideal. Again, by Eichler's theorem (Proposition 14. ip . we see that / is principal 
if and only if nrd(7) C Zp is trivial in Cls^ Zp, and the latter can be tested as in 
§2. In other words, simply testing if a right O-ideal is principal is no harder than 
testing if an ideal is principal in Ip. 

To then actually exhibit a generator for a principal ideal, we rely upon the 
following standard lemma (see Pizer t 39, Proposition 1.18]). 

Lemma 4.8. Let I be a right invertible fractional O-ideal. Then J £ I generates 
I if and only if m:d(^)Zp = nrd(7). 

By Lemma 14.81 the right ideal / is principal if and only if there exists 7 6 J 
such nrd(7) = nrd(I) = cZp (with v(c) > for all v G Soo). Unfortunately, since 
B is indefinite, the norm form Tr nrd : B — > Q is not positive definite, hence it 
does not induce the structure of a (definite) lattice on / (in the definite case it 
will, see §§6-7). One option is to use a form of indefinite lattice reduction (as in 
Ivanyos-Szanto [24 ) . We instead find a substitute quadratic form which will still 
allow us to find "small" elements. When F is totally real and B has a unique split 
real place, such a form has been found [SOj . and inspired by this result we make the 
following definitions. 



Let B — I — — I . For an infinite place v of F and 7 = x + ya + zf3+ waj3, define 



by construction, the form Q is positive definite and gives / the structure of a definite 
Z-lattice of rank 4[F : Q]. 

Remark 4.10. The form Q is clearly only one of many choices for such a positive 
definite form, and so one may reasonably try to understand what the cone of such 
forms corresponds to. 

When F is totally real and B has a unique split real place, the choice of the 
positive definite quadratic form corresponds to the choice of a center p for a Dirichlet 
fundamental domain in the upper half-plane ft and at the split place measures the 
inverse radius of the corresponding isometric circle |50j . The same is true for a 
quaternion algebra of arbitrary signature as follows. If B has g split real places and 
s (split) complex places, then the group 0\ of units of O of reduced norm 1 embeds 
in SL 2 (M) 9 x SL 2 (C) S and acts on ft 9 x (H 3 ) s discretely, where Sj (resp. H 3 ) denotes 
the upper half-plane (resp. hyperbolic 3-space) (see e.g. Beardon [3] and Elstrodt, 




(4.9) Q v (l) - Hx)\ 2 + \v(a)\\v(y)\ 2 + \v(b)\ \v(z)\ 2 + \v(ab)\\v(w)\ 2 . 
We then define the absolute reduced norm by 

Q : B -> R 

7^ T,vQv(7)\ 
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et al. [2Q]). In this case, the choice of a positive definite quadratic form corresponds 
again to the choice of a center p for a Dirichlct domain and at each place measures 
an inverse radius, either of an isometric circle or sphere. The above choice of form 
Q corresponds to a (normalized) choice of center p — (i, . . . , i, j, . . . , j). 

Because of the connection with the classical theory of positive definite quadratic 
forms on a real quadratic field, which can be understood more generally from the 
perspective of Arakelov theory [42] . we view these observations as the beginning 
of a form of noncommutative Arakelov theory and leave it as a subject for further 
investigation. 

We then have the following algorithm. 

Algorithm 4.11. Let / C O be a right fractional O-ideal. This algorithm solves 
Problem [2^41 (IsPrincipal). 

1. Compute nrd(I) C If and test if nrd(7) is principal; if not, then return 
false. Otherwise, let nrd(7) = cLp- 

2. Determine if there exists a unit u £ Z* F such that v(uc) > for all ramified 
(real) places v; if not, then return false. Otherwise, let c := uc and initialize 
a := 1. 

3. If c e Z* F , return a. Otherwise, view / as a Z-lattice equipped with the 
quadratic form Q. Reduce / using the LLL algorithm [33] . By enumerating 
short elements in I, find 7 £ I such that nrd(7) = cd with N(c?) < N(c). 
Let a := ja/d, let / :— dy I, and let c := d, and return to Step 2. 

Proof. In Step 2, we have nrd(d7 _1 I) = d 2 /(cd) nrd(/) = eKp, and so the algorithm 
terminates since in each step Nnrd(I) £ Z>o decreases. The algorithm gives correct 
output since dy^I — aO if and only if / = (ya/d)0. □ 

In practice, Algorithm ic 1 ll runs quite efficiently and substantially improves upon 
a more naive enumeration. However, we are unable to prove any rigorous time 
bounds for Algorithm 14.111 Already the first step of the algorithm requires the 
computation of the class group QA7Lp\ and even if we suppose that the class group 
has been precomputed, there do not appear to be rigorous time bounds for the 
principal ideal testing algorithm dl, Algorithm 6.5.10] (see §1). With that proviso, 
given the generator c as in Step 1, we can measure the value of the LLL-step as 
follows. 

Lemma 4.12. There exists C(0) £ K>o, depending on O, such that for every 
principal fractional ideal I of O, the first basis element 7 in the LLL-reduced basis 
of Algorithm 14.111 satisfies 

|N(nrd( 7 ))| < C(C)N(nrd(/)). 

Proof. Suppose that / = £0. The F-cndomorphism of B given by left multi- 
plication by £ has determinant nrd(£) 2 , and it follows that the corresponding Q- 
endomorphism of L (g>z Q has determinant N(nrd(£)) 2 . Hence 

det(7) = det(£0) = N(nrd(£)) 4 det(O). 

Now, for any 7 = 2; + ya + z[3 + wa(3, from (|4.9p we have 



Knrd(7))| < Qv(l) < Q(7) 
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for all places v. Thus, the output of the LLL algorithm [33], Proposition 1.9] yields 
76/ which satisfies 

Knrd( 7 ))| < Q( 7 ) < 2( 4n - 1 )/ 4 det(/) 1/(4n) = 2^ n ~ 1 ^ A dct(C) 1/(4n) N^rd^)) 1 /". 
We conclude that 

|N(nrd( 7 ))| = JJ|u(nrd(7))| < 2( 4 " 2 " n )/ 4 det(O) 1 / 4 N(nrd(/)) 

V 

as claimed. □ 

From Lemma 14.81 we conclude that the algorithm produces elements which are 
close to being generators. 

5. Computing the class number for definite orders 



In this section, we discuss the difficulty of solving Problem 12. II (ClassN umber) in 
the definite case. Throughout this section, let B denote a totally definite quaternion 
algebra of discriminant 2). Here, the class number is governed by the Eichler mass 
formula. 

Given an ideal 9t (coprime to 35), the mass is defined to be the function 

(5.1) M(3),9t) = 2 1 - n |0K-l)|/i(Z F )$(!D)#(9t) 
where 

(5.2) $(©) = JJ (N(rt - 1) and *(9t) = N(9t) J] (l + ^-r\ . 

The mass of an Eichler order OcBof level 91 is defined to be M (O) = M (£>, 91). 

The class number of an Eichler order differs from its mass by a correction factor 
coming from torsion, as follows. An embedded elliptic subgroup in B is an embedding 
fi q O* /Zp, where q £ Z>2 and O is an Eichler order, such that the image is 
a maximal (cyclic) subgroup of O* /Z* F ; the level of the embedding is the level of 
O. An elliptic cycle is a £?*-conjugacy class of embedded elliptic subgroups. Let 
e q (D, 91) denote the number of elliptic cycles of B* of order q and level 91. 

Proposition 5.3 (Eichler mass formula [44, Corollaire V.2.5]). Let O C B be an 

Eichler order of level 91. Then 



h(O) = M(D, 91) + e q (p, 9t) ( 1 - - 



q 

Remark 5.4. A variant of the Eichler mass formula [21 Corollaire V.2.3] which is 
also useful for algorithmic purposes (see Remark IT. 5[) reads 

M(£>,9t)= ^ ' 
[j]ecio 



We first characterize the embedding numbers e q (3D , 91) . Given an embedded 
elliptic subgroup fi q O* /Z F of level 91, the image of \x q generates a quadratic 
subring R C O; such an embedding R <—* O with RF n O = R is said to be an 
optimal embedding. Conversely, to every optimal embedding l : R <— > O, where R 
is a quadratic Z^-order with [R* : % F \ — q and O is an Eichler order of level 91, we 
have the embedded elliptic subgroup R^ ms /Z* F = [i q O*. This yields a bijection 



16 



MARKUS KIRSCHMER AND JOHN VOIGHT 



{Elliptic cycles of B* of order q and level 91} 

I 

B*-conjugacy classes of optimal embeddings l : R O 
with [R* : Zp] = q and O an Eichler order of level 9T 

The quadratic Z^-orders R with [R* : Z F ] = q come in two types. Either we 
have i?tors — A*2g and we say R is fully elliptic, or [R* : Zpi?j* ors ] = 2 and we say R 
is half elliptic. We see that if R is half elliptic then in particular R C 7Lp\\J~^e\ for 
e a totally positive unit of Z^ . 

The (global) embedding numbers e 9 (2), 91) can then be computed by comparison 
to the local embedding numbers 

m(R p , O p ) = #{C*-conjugacy classes of optimal embeddings 1 : R p <— ► Op} 

where Op is a p-local Eichler order of level 91. 

Lemma 5.5 (@U P- 143]). We have 



e q (V,m) = l Yl HR)l[m(R p ,O p 



2 

[R*:1* F ]=q V 

There are formulas [49l §2] for the number of local embeddings m(Rp, O p ), for 
example: 



(5.6) m(R p ,Op)=< 



1, ifp{S9T; 

if p I S andp|f(i?); 

— ). if p || 0T; 



1 - 




1 + 


(K q 

V p 



here, we let K q — F((,2q) and f(i?) denotes the conductor of R (in Zif ). In 
particular, we have by Equation (|5.6[) that m(i?p,O p ) = 1 for almost all p. 

We now discuss the computability of the terms in the formula of Proposition l5.3l 
To compute the mass, we will use the following proposition. 

Proposition 5.7. The value Cf( — 1) € Q can &e computed using 

0(4 /2 log 4 aV) 

&ii operations. 

Proof. From the functional equation for the Dedekind zeta function, we have 
(5-8) Cp("1)= [0^ of/ 2 CF{2). 

From (|5.1[) and Proposition 15.31 we have Cf(~ 1) <= m f ac tj Cf( — 1) nas de- 
nominator bounded by Q, the least common multiple of all q £ Z>2 such that 
IHbi) ■■ F] = 2. 

We compute an approximation to Cf(— 1) from the Euler product expansion for 
Cf(2), as follows (see also Buchmann- Williams §2], or Dokchitser [TT] for a more 
general approach). For P € Z>2, let 

<>^«= n (i-n^ 

Np<P v r 
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denote the truncated Euler product for (f(s), where we take the product over all 
primes p of %p for which Np < P. Note that for s > 1 real we have 



Cf,<p(s)<CAs)=U{i-^) l <U(l-±;) =«-)*■ 
Now we estimate 



/Vn2 + X! 



]Vp2 N(pq) 2 

Np>P r Np>Nq>P vrM; 



, p 2 ^ (p<j) 2 ~~ ^—1 X 2 ^„ X 2 



< 



p>P' P,q>P x>P x>P 2 

n n 2 1 



P P 2 (P/n) - 1 ' 

It follows that Cf(2) — Cf,<p(2) < e whenever P > nil + Cp<p(2)/e) which is 



satisfied when 



P > n 1 + = n 1 + v 7 ; 



To obtain the value 1) within an interval of length smaller than 1/(2(2), from 
(|5.8|) it suffices to take 

_ 1 (2tt 2 )" 

To estimate Q, we note that if [-FXC25) : -F] = 2 then in particular F contains the 
totally real subfield Q(C 2g ) + of Q(( 2g ), hence 0(g)/2 | n. Since the fields Q(C2 9 ) + 
are linearly disjoint for q a power of a prime, we have Q = 0(n). (We note this 
bound is best possible in terms of n, since after all we may take F — Q(C2g) + -) 
Putting these together, we need to evaluate the truncated Euler product with 

7T \ 1 \ _ ( n l , 3/2 



P = n —) - ) = —d 



6 e V 12" 



F 



Evaluating ^<p(2) amounts to factoring a degree n polynomial over F p for all 
primes p < P; each such factorization can be performed using a repeated squaring 
operation, requiring 0(n 3 logp) operations in ¥ p (see e.g. the survey by von zur 
Gathen and Panario [23]) so time 0(n 3 log 3 p), hence altogether time 0(n 3 P log 2 P) 
by the prime number theorem, so the computation requires 



O I ^4 /2 log 3 d F J = 0(4 /2 log 3 dp) 

operations with real numbers of precision 0(1 /e) = C^d 3 / 2 ), requiring therefore 
0(d 3 J 2 log 4 c^f) bit operations. □ 

Remark 5.9. If _F is an abelian field, then <^p(— 1) can be computed much more 
efficiently in terms of Bernoulli numbers }52j . 

Putting these pieces together, we now prove the following theorem. 
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Theorem 5.10. There exists a probabilistic algorithm which, given an Eichler order 
O in a definite quaternion algebra B with factored discriminant d, solves Problem 
(ClassNumber) in time 

0(4 /2 log 4 dp + log 2 Nd) 
and the time to solve 0(2") instances of Problem (ClassUnitGroup) with fields of 
discriminant of size 0(d 5 J 2 ). 

Proof. First, we compute the factored discriminant D of B and level 91 of O by 
computing Hilbert symbols 51J: given the factorization of the discriminant d of 
O, for each p | d one can determine whether p | D or p | 91 in deterministic time 
C>(log 2 Np). 

We compute h(0) from the Eichler mass formula (Proposition 15. 3|) . with the 
mass M(D, 9t) given as in Equation (|5.1|> . Given the factorization of D and 9t, we 
can compute $(£) and \ff(9t) in time 0(log 2 N(ID9t)). One recovers h(Z F ) from 
the given algorithm to solve Problem (ClassUnitGroup). By Proposition 15. 71 we can 

compute |Cf(— 1)| in time 0(d 3 J 2 log 4 dp). 

We now estimate the time to compute the correction term ^2 q e g (2), 91) (1 — 1/q) 
in Lemma T5. 51 up to further instances of Problem (ClassUnitGroup). 

As in the proof of Proposition 15.71 if e g (£),91) ^ then q = 0(n). Thus, by 
factoring n (which can be done in negligible time using trial division) we obtain 
a finite set of 0(n) possible values of q. For each such q, we can factor the qth 
cyclotomic polynomial over F in deterministic time (qn log dp) ^ (see Lenstra 
|31j ) and determine if each of its irreducible factors has degree 2. (In practice, one 
might further restrict the set of possible q by verifying that q \ dp if q > 5 and that 
for sufficiently many small prime ideals p of Zp coprime to qdp that q | (iVp 2 — 1), 
but this makes no difference in the analysis of the runtime.) Since q = 0(n) and 
n = 0(\ogdp) by the Odlyzko bounds [38], this becomes simply (log dp)°^ . 

We pause to compute an estimate of discriminants. Let q € 1>i be such that 
K = F(^2q) is quadratic over F. We estimate the discriminant d^ — dp N f /q Vk/f- 
Let X 2q = ( 2q + l/Ciq'i tncn we have Q{C, 2q ) + = Q(A 2 ,) and C| 9 - A 2g C2 9 + 1 = 0, so 
*k/f I (>4q - 4)Zi?. Therefore 

N Q(C2 < ,) + /q( A 2< Z - 4 ) = N Q(C2 g ) + /Q(C2g - 1/C2g) 2 = Nq( C2? ) /Q (Cg - 1) 

{p, if q — p r is an odd prime power; 
4, ifq = 2 r ; 
1, otherwise. 

So d K = d 2 F Np /Q V K/F < d 2 F Np /q (X 2 q - 4) = 4p 2 «M2«) if q = p r is an odd 
prime power, and similarly dp < d F 4 2n '^ 2q ' if q = 2 r and dp — d 2 F if q is not 
a power of a prime. For q a power of a prime p, by the conductor-discriminant 
formula [5H Theorem 3.11] we have p^ 2 ^/ 2 " 1 \ d Q{C2q) +, so since d 2 ^ {2 f \ dp 

we have p n = 0{d F ). Thus we have p 2n /^ 2 i) = 0(d 2 J' p{2q) ) = 0{d]l 2 ) when 

q = 5 or q > 7, and hence dp = 0(d F ); but for q < 4 this also holds, since 
by the Odlyzko bounds there are only finitely many (totally real) number fields 
with d F < 16™. When K = F(yf^e) for e a totally positive unit of Zf, we have 
dp = 0(d 2 F A n ) = 0(d 5 J 2 ) as well. Thus in all cases, dp = 0(d 5 J 2 ). 
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To compute e g (2), 9t), we need to compute h(R) for all R C K with [R* : Zp] = q. 
First, suppose that R is fully elliptic. Then Xp[C,2 q ] CfiC %k- We have the bound 
f(-R) 2 | {\\ q — 4) | p on the conductor of i? as above, which implies there are at 
most 0(2™/*( 2,? )) = 0(dp) such orders, corresponding to the possible products of 
ramified primes over p in the extension F/Q(^2 q ) + - Each can be constructed by 
computing p-overorders for p 2 | (A 2 g — 4) | p, requiring time q ^ 1 ). Now if f = f(-R), 
we have 

htm = MZ/Q #(z x /fz g )* 

1 ' [Z* Kq :R*]#(Z F /fZ F )* 

and the time required to compute these terms is negligible except for h(Zj( ), for 
which we may call our hypothesized algorithm. 

Next, suppose that R is half elliptic. In this case, we have 7Lp\\J — e] C R C Z^. 
Here, we have the bound f(-R) 2 | 4, hence there are at most 0(2 n ) = 0(dp) such 
orders, and the arguments in the preceding paragraph apply. 

In all, we have at most 0(2") imaginary quadratic fields K to consider, the worst 
case being when F has a fundamental system of units which are totally positive. 

Finally, the calculation of the local embedding number m(i? p ,O p ) can be ac- 
complished in time 0(log 2 (Np)) for p odd [49J Proposition 2.5] by computing a 
Legendre symbol (and in time O(l) after that) and in time = (logdp) ^ for 

p even [US Remark 2.6]. 

In all, aside from the time to compute class numbers, since there are 0(n) values 
of q, we can compute the correction term in time 

0(log 2 N(D9T)) +d F (log^)° (1) + (logd F )° (1) . 
Combining this estimate with the time to compute the mass, the result follows. □ 

Corollary 5.11. For a fixed number field F, Problem 12.11 (ClassNumber) for def- 
inite orders O is probabilistic polynomial-time reducible to the factorization of the 
discriminant of O . 

Proof. Only the quantities < I > (X'), ^'(91), and m(Rp,O v ) depend on O — the others 
can be precomputed for fixed F. These quantities can be computed in probabilistic 
polynomial time knowing the factorization of £) and □ 

Putting together Corollary 14.21 Theorem 15 . 101 and Corollary 15. Ill we have 
proven the main Theorem A and its corollary. 

We conclude this section by discussing the role of factoring the ideals 2), 91. 
It is well known that factoring ideals in the ring Z F is probabilistic polynomial- 
time equivalent to factoring integers. But already for imaginary quadratic fields, 
it is also well known that an algorithm for (ClassUnitGroup) can be employed to 
factor integers (two such "class group" methods are attributed to Schnorr-Lenstra- 
Shanks-Pollard-Atkin-Rickert and Schnorr-Seysen-Lenstra-Lenstra-Pomerance). A 
noncommutative analogue of this result, already in the simplest case where F = Q, 
is the following. 

Proposition 5.12. The problem of factoring integers a with uj(a) = O(logloga) 
prime factors is probabilistic polynomial-time reducible to Problem (ClassNumber) 
for definite quaternion algebras over (Q). 
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Proof. For F = Q, the class number is given simply by 

Let a £ Z>o be an integer to be factored, which we may assume has gcd(a, 26) = 1 
and is not a prime power. 

We consider quaternion algebras of the form B = ( J where 6, c G Z>o 



are chosen as follows. We choose c € {1, 2} so that (— ac/13) = — 1: therefore the 
algebra B is ramified at 13 so 13 | D, and it follows that e2(D, N) = ez{D, N) = 
by (|5.6p . hence 

= <f>(D/lS)i/)(N). 

For simplicity, we assume c = 1; the same argument applies when c = 2. 

We choose 6 to be a random squarefree factored positive integer modulo 4a (see 
e.g. Bach [2]) with gcd(6, 26) = 1. If gcd(a, 6) ^ 1 and l,b, we have factored a. 
Otherwise, with probability at least (1/2)^'°^, we have (— 13b/p) = 1 for all p \ a, 
so then p ] D for all p \ a; since ui(a) — O(logloga) by assumption, after O(loga) 
attempts this condition will be satisfied with probability at least 1/2. 

Now compute an order O C B which is locally generated by the standard gen- 
erators a, for all primes p ^ 2 and which is maximal at 2. Then O is an order 
with discriminant 13a6e = DN where e = 1 or 2. We claim that O is Eichler. Since 
gcd(a, b) = 1 and b is squarefree, and further a, 6 are odd, it suffices to show that 
O is Eichler at p | a. But for such p e \\ a, by assumption we have (— 136/p) = 1 
so £> is unramified at p, and there exists ( e Z* such that t 2 = —136. Then the 
embedding O ^ O ®% Z p by 

a ^(ac J)' ^(o -t 

realizes O as an Eichler order of level p e . 
It follows that 

pK-D/13) P e ||iV 

if a is not squarefree then gcd(/i(C), a) yields a prime factor of a, so we may assume 
that a is squarefree. 

We now show how to recover a prime factor of a given the values h(O). For each 
prime p \ b, by computing (—ac/p) we can determine if p is ramified in B or not, 
accordingly contributing a factor p — 1 or p + 1 to h(0). Dividing /i(O) by these 
factors, we may compute the integer 

9(b) =Y[(J>-1)1[(J> + 1) 

p\D' p\N' 

and ea = D'N'. We compute one such value g(b) and then many more values g(b'), 
and we claim that gcd(g(b)+g(b'), a) will find a factor of a. Indeed, with probability 
at least w(a)(l/2)"( a ' +1 , we will have the following: 



There exists a prime q \ a for which (— 136/g) = — (— 13b'/q) and 
(— 13b /p) — (—13b'/p) for all p \ ea with p ^ q. 
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It follows then that g(b) = —g{b') (mod q) as claimed. Again, since by assumption 
uj(a) = O(logloga), after O(loga) attempts we will factor a with probability at 
least 1/2. □ 

6. Ideal principalization for definite orders 



In this section, we discuss the totally definite case of Problem 12.41 f IsPrincipaO. 
which by Lemma l2~5l is equivalent to Problem l2.3l (Islsomorphic). We exhibit an al- 
gorithm (Algorithm [6T3J) to solve this problem and analyze its running time (Propo- 
sition [Hill]). This algorithm will be used in the next section to solve Problem 12.21 
(ClassSet) for definite orders. Throughout this section, let B be a totally definite 
quaternion algebra over a totally real field F of discriminant T) and let O C B be 
an Eichler order of level 91. 

Our algorithm is similar to the indefinite case (Algorithm 14. 1 1 j ) . where now we 
are in the easier situation that Tr nrd : B — > Q is a positive definite quadratic form 
on the Q- vector space B. We make use of an improvement due to Dembele and 
Donnelly [15[ §2.2], and we prove below that their idea reduces the principalization 
problem to a shortest lattice vector problem. 

First of all, if / is a principal right fractional O-ideal, then nrd/ = dZp is a 
principal ideal oiZp. To compute such a generator c^TLp over a general number 
field F, we refer to the discussion following Proposition 11.31 For F totally real as 
in this section, we first show that a principal ideal has a generator of polynomial 
size, with the constant depending on F. For a real place v of F, corresponding to 
an embedding v : F «— ► R, we abbreviate a v = v(a) for a£f. 

Lemma 6.1. For a principal fractional ideal a C F, there exists a generator a for 
o with \a v \ — 0((Na) 1 '") for all real places v of F, where the implied constant is 
effectively computable and depends on the field F . 

Proof. Consider the (Minkowksi unit) map 

a : F — ► R™ 

u i > (log - (l/n)logN(w)) t , 

where v runs over the real places of F. The image <r(F) is contained in the hyper- 
plane H : J2 V x v = 0> anc ^ the image of the units <r(Z^) forms a lattice (of full rank 
n — 1) in H. But since o is principal, the image <r(o) C H is simply a translate 
of this lattice. It follows that there is a generator a for a with a (a) inside a fun- 
damental parallclopiped for cr(Z^). Therefore, if u\, . . . ,u n —i € Up are a basis for 
Z F /{±1}, then for each real place v we have 



log|a„| - -logN(a) 
n 



_^ 71— 1 

< 2 H l lo sk 

i=l 



Let U v = nr=i el los l"*^l/ 2 . Then 



so if U = max U v then 



-^N(a) 1 /" < |a„| < ^N(a) 1 /" 

u v 

-^N(a) 1 /" < \a v \ < [/N(a) 1 /" 



for all v, as claimed. □ 
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Remark 6.2. Although we will not make use of it, we remark that Lemma 16.11 
gives a method for testing if an ideal a is principal over If and, if so, exhibiting a 
generator. We simply enumerate all elements a £ with \a v \ < JJN(a) 1 /" for all 
v, where U is as in the above proof; we can accomplish this by embedding TLp <—* W l 
by a i— > (a v ) v as a lattice (by the Minkowski embedding) and enumerating all lattice 
elements of (square) norm bounded by nil 2 N(a) 2 /". By the analysis of Fincke and 
Pohst 21, (2.12), (3.1)] (or alternatively Elkies [T51 Lemma 1]), we can enumerate 
all such elements in time 0(N(a)), where the implied constant depends only on F. 

We now present the main algorithm in this section. 

Algorithm 6.3. Let / C O be a right fractional O-ideal and let c £ If such that 
nrd/ = cLp- This algorithm solves Problem 12.41 flsPrincipaO. 

1. Determine if there exists a unit u £ 1? F such that c v u v > for all real 
places v; if not, then return false. Otherwise, let c := cu. 

2. Let X\, . . . , x n be aZ-basis of Zp. For each real place v, let k v :— \xi >v |/2. 
Compute 

2 i/n _ 1 
e := 2 1 /" + 1 ' 

and let 

C := 6 max - — . 

3. For each totally positive unit z £ Z F+ /1* F 2 : 

a. For each real place v of F compute r v := C / ^Jc v z v . Represent the 
vector (r v ) v in terms of the basis x\, . . . ,x n and round the coordinates 
to integers to obtain a £ Zp. 

b. Find the shortest vectors in the Z-lattice al; if a shortest vector £ has 
nrd(£) = a 2 cz, return true and the element £/a. 

4. Return false. 

Remark 6.4. Note that if F = Q then in Step 3 we have z = 1 and Step 3(a) can 
be neglected (since it simply rescales the lattice), and hence one can directly find 
the shortest vectors in the Z-lattice /. 

Proof of correctness. The correctness of the algorithm is a consequence of Lemma 
14.81 and the fact that any generator must have totally positive norm, once we show 
the following claim: if / = Ot; with nrd£ = c then at; is a shortest vector in the 
lattice al with a as in Step 4(a). 

First, by rounding note that \a v — r v \ < k v for all v. Since 

2 i/n _ 1 

2 l/n + i 

we easily deduce that 

1 + e _ 9 l/n 
1-e ■ 

Now suppose £, £ B satisfies / = 0£ with nrd£ = c. We first give an upper 
bound on the (square) norm of at; in the lattice al. We have 
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By the quadratic formula, we then have 

(6.5) eC 2 - 2y^n v C - k 2 v c v > 
and rearranging (|6.5[) we obtain 

\a 2 v c v - C 2 \ = \a vy /c^ — C\\a v */c^+C\ < n v ^k v + ^=^J °v < £ C 2 - 

Therefore 

(l-e)C 2 < a 2 v c v < (l + e)C 2 

Finally, if nrd £ = c then 

Trnrd< = Tr a 2 c = ^a 2 ^ < n(l + e)C 2 < n (\^) ]J{a 2 v c v ) 1/n 

(6.6) " 6 v 
<n2 1 /»J] (a 2 c .„) 1 /«. 

V 

Now suppose that X £ I and A is not a generator of /. Then nrd(A) is a multiple 
of nrd(Z) so Nnrd(A) is a multiple of Nnrd(Z) = Nc. Thus 

] [ a 2 nrd„ A = N(nrd aX) > 2 N(nrd a£) = 2 JJ a 2 c„. 

V V 

But by the arithmetic-geometric mean inequality, we have 

(6.7) TrnrdaA = ^a 2 v nrd„ A > n\\{a 2 v nrd„ A) 1/n > H2 1 /™ ^(a^c,,) 1 /". 



Combining (|6.6p with (|6.7p we have proven the claim. □ 

To analyze the runtime of Algorithm 16. 3( we first state and prove some prelimi- 
nary results on enumeration of (short) vectors in lattices. 

Lemma 6.8. There exists an algorithm which, given a lattice L with basis vec- 
tors each of (square) norm at most A G M>0) finds the shortest vectors in L in 
deterministic time 0(log 3 ^4) for fixed dimension n. 

Proof. This lemma is a consequence of the celebrated LLL-algorithm of Lenstra, 
Lenstra, and Lovasz [33 j : see e.g. Kannan [26l Section 3]. □ 

Remark 6.9. Using floating-point LLL, one could probably replace log 3 A with 
log 2 A in the lemma above, but this will have no impact on what follows so we 
neglect this possible improvement. 

We pause to prove two results which will be used in the next section. 

Lemma 6.10. A uniformly random element of a lattice L with norm < A can be 
computed in probabilistic probabilistic time (where the implied constant depends on 
the lattice L ). 

Proof. Choose a random vector «eZ" with each component Vi chosen uniformly 
in the range [—y/A,-^A]. Using linear algebra over Q, determine if v € /; if 
so, output the vector, otherwise start again. This test can be performed by first 
computing once (for the lattice L) the change of basis from / to the standard basis 
and then multiplying the vector v by this matrix. The entries of the inverse will 
be of polynomial size for fixed dimension, and so each test can be performed in 
polynomial time. The probability of success in each trial depends on the density of 
the lattice, given by its determinant. □ 
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We apply this lemma to computing representatives of ideal classes, which we will 
use in the proof of Lemma 17.91 

Lemma 6.11. There exists an algorithm which, given x G Z>o sufficiently large 
and an ideal class [a] G Cls^iZp), computes a uniformly random ideal b C Zj? 
with [b] = [a] and N b < x, which runs in probabilistic polynomial time over a fixed 
totally real field F . 

Proof. Let b C Zp be an ideal such that Nb < x and [b] = [a]. Then bo -1 is 
principal. By Lemma |6.1[ there exists a generator a for ba _1 with 

|a„| < L/N(ba -1 ) < Ux/Na = T 

for all real places v of F, where U is an effectively computable constant depending 
only on F. In particular, we have that 

{b : Nb < x, [b] = [a]} C {acT 1 : a G Z F , \a v \ < T}. 

Now each fractional ideal of F is naturally a lattice under the Minkowski em- 
bedding a : F — > R" by x i— > (x v ) v . Denote by SV(L) the set of shortest vectors in 
a lattice L. Then the map 

{a G Z F : \a v \ < T for all v and a G SV(aZ F )} -> {b : N b < x and [b] = [a]} 

a i— > b = aa -1 

is a surjective map of finite sets. If we draw an element a G Zi? on the left-hand 
side with probability l/fj= SV(aZp) and an ideal b on the right-hand side uniformly, 
then this map preserves probabilities. 

Therefore, we may compute a uniformly random ideal b as follows. First, we 
compute a uniformly random element a G cT 1 such that N(a) < i/No and let 
b = aa. We find such an element a by finding a uniformly random element a G 
a -1 of (square) norm < nT 2 in the Minkowski embedding, which can be done in 
probabilistic polynomial time by Lemma 16.101 If Na > T, we return and compute 
another random a. Given a with N a < T, we compute the shortest vectors in the 
lattice aLp, which can be done in deterministic polynomial time by Lemma 16.81 
(since a is of polynomial size, the lattice oJLp has a basis which is of polynomial 
size with the constant depending on the size of a basis for Zp). If a is not a shortest 
vector, we return and compute another element a; if a is a shortest vector, then we 
keep a with probability l/ffSV^aZp) and otherwise return. □ 

We conclude this section by analyzing the runtime of the principalization algo- 
rithm. 

Proposition 6.12. Algorithm 16.31 runs in deterministic polynomial time in the size 
of the input over a fixed totally real field F. 

Proof. In Step 1, we must solve Problem (ClassUnitGroup) for the field F which can 
be done in constant time. In Step 2, we note that logC is of polynomial size in the 
input, with the constant depending only on F. In Step 3, there are at most 
totally positive units z. For each, in Step 3(a) the Z-lattice al has basis vectors with 
norm of polynomial size in the input pseudobasis for /, with the constant depending 
on F. In Step 3(b) we find the shortest vectors in this lattice, and by Lemma 16781 
this can be performed in deterministic polynomial time in fixed dimension. □ 
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Remark 6.13. We now present an alternative approach to Corollarv l3 . 71 which solves 
Problem 12.71 (IsConjugate) for a definite algebra by constructing an isomorphism 
directly. Let 

O(B) — {ip S EndF(-B) : nrd(y>(x)) = nrd(a;) for all x e B} 

where Endi?(_B) denotes the endomorphisms of B as an F- vector space, and 

SO(B) ={<pe 0(B) : de%) = 1}. 

It is well known (see e.g. Dieudonne [TH1 Appendix IV, Proposition 3]) that 

SO(B) = {cf>: x i-> vSxS' 1 :v,5e B*, md(v) = 1}. 

Since conjugation is an order-preserving anti-automorphism of determinant — 1, we 
have the following result: Two orders O and O' of B are conjugate if and only if 
there exists ip e 0(B) such that <p(0) = O' . 

Therefore, such an isometry can be found using the approach described by 
Plesken and Souvignier [40 . 

Remark 6.14. For a definite quaternion order O, we define its theta series simply 
to be the theta series of the corresponding lattice under the quadratic form Tr nrd, 
i.e., 

9(o; q ) = Y,v TlDim ^nm- 

{GO 

Isomorphic quaternion orders have the same theta series, and so given a complete 
set of representatives {Oi} for the set of conjugacy classes of (definite) Eichler 
orders of a given level, one can identify the conjugacy class of a given order O by 
comparing the first few coefficients of their theta series. This approach is more 
efficient in practice to show that two orders are not conjugate than to test for 
conjugacy directly. 

In this way, one can also show that two right ideals of an order O are not 
isomorphic, by showing that their left orders are not conjugate, and this idea can 
be used in practice to speed up the enumeration of ideal classes. 

7. Computing the class set for definite orders 

In this section, we discuss Problem l2.2l (ClassSet) in the totally definite case. The 
key algorithm is the S-neighbors algorithm ( Algorithm El]), but see also Algorithm 
I7.13[ and its running time is analyzed in Proposition 17.71 The main result (the 
definite case of Theorem B) appears as Theorem 17.111 As in the previous section, 
let B be a totally definite quaternion algebra of discriminant D and let O C B be 
an Eichler order of level 91. 

One way to solve Problem (ClassSet) is to simply enumerate the right invertible 
fractional O-ideals in some way, building a list of ideal classes by testing each ideal 
(an instance of Problem (Islsomorphic)) to see if it is isomorphic to any ideal in 
the list, and stopping when one knows that the list is complete. Ultimately, our 
methods to solve Problem (ClassSet) will be a variant of just this simple idea. We 
use the mass formula (Proposition 15. 3| ) and the accompanying solution to Problem 
(ClassNumber) and stop when equality holds. (See also Remark 17.51 below for the 
use of the alternate mass formula.) 
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Remark 7.1. In the commutative case, one bounds the norm of the ideals in a gen- 
erating set for C1Z F using a Minkowski- like bound (or the Bach bound, assuming 
the GRH). One can in a similar way use the geometry of numbers in the case of 
quaternion algebras: the first author [27j has proven that if O is maximal, every 
ideal class in CI O is represented by an ideal I with 

nrd(J) < M n d F VWD 

where M n is a constant growing exponentially with n. Although this bound is 
effective, just as in the commutative case, it would be all but useless in practice 
except in the simplest cases. 

To enumerate ideals, we note that the group C1Z F acts on the set of isomorphism 
classes of fractional right O-ideals by multiplication (on the left or right). We say 
that an invertible right (integral) O-ideal I is primitive if I is not contained in any 
nontrivial two-sided ideal of the form J = aO with oCZj. We note that I C J if 
and only if IJ^ 1 C O is integral, and if I C J then nrd(J) | nrd(J) so / is contained 
in only finitely many two-sided ideals J. 

Therefore, to enumerate all right O-ideals, we enumerate the products JI of 
primitive right O-ideals I and two-sided ideals J = aO. To enumerate primitive 
right ideals, we employ the following lemma. For a commutative ring R, we denote 

by 

F 1 (R) = {(x,y) : xR + yR = R}/R* 
the points of the projective line over R, and denote by (x : y) the class of (a;, y) in 
P x (i?). 

Lemma 7.2. Let a be an ideal of ' Zp coprime to DDL Then the set of primitive 
right invertible O-ideals of norm a are in bijection with P 1 (Z^/a). Explicitly, given 
a splitting 

^ a :0^0® ZF Z Fa S Af 2 (Z F , a ) Af 2 (Z F /a) 
the bijection is given by 

¥ 1 (Z F /a) -> {I C O : nrd(7) = a} 

(x : y) h+ /(*:,)= 4*- 1 [j)o + aO. 

Proof. We may refer to Vigneras [BJ Chap. II, Theoreme 2.3(3)]); for convenience, 
we give a proof here. 

It is clear that the ideal Ir x:y ) is a right O-ideal of norm a; it is invertible since 
it is locally principal, and it is primitive since the only two-sided ideals with norm 

fx 0\ 

dividing a are of the form pO with p \ a, and I ^ pM2(Z F a ) for any such p. 

To prove the lemma, it suffices to construct an inverse map. Let I be a right 
invertible O-ideal of norm a. Then <fi a (I) is a right principal M2 (Zp/a)-ideal, say, 
generated by £ 6 A^Zp/a). We have det(£) = 0, so the kernel 

V = {ve (Z F /a) 2 :< = 0} 

of £ acting on the right is nonzero. We claim in fact that V is a free Z F /a-module 
of rank 1. Indeed, for each prime p | a, we have V/pV one-dimensional since I is 
primitive and hence £ ^ (mod p); it follows from a Hensel lift that V/p e V is also 
one-dimensional, and the claim then follows by the Chinese remainder theorem. 
This argument also shows that a generator v = (x,y) of V has [x : y) € P x (Z F /a) 
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(and this element is unique), since this is true modulo p for all p | a. Thus the 
association / t— > (—y : x) is well-defined, and it is easy to see that this furnishes the 
desired inverse. □ 

One natural way to enumerate primitive ideals / would be to order them by 
N(nrd(/)), the absolute norm of their reduced norm. Alternatively, one may restrict 
the set of possible reduced norms as follows. 

Proposition 7.3 (Strong approximation). Let S be a nonempty set of (finite) 
prime ideals ofliF coprime to 1) which generate Cls^ I^f- Then there exists a set 
of representatives I for CIO such that nrd(/) is supported in S . 

Proof. See Vigneras [HI Theoreme III. 4. 3] and the accompanying discussion. □ 

Let p be a prime ideal of Z^, and let /, J be right invertible O-ideals. Then J 
is said to be a p-neighbor of I if I D J and nrd(J) = pnrd(I), or equivalently if 
[I : J] = p 2 , the index taken as Z^-lattices. Following Schulze-Pillot 43J, Pizer [55] . 
Kohel [29], and Mestre [37]), we enumerate primitive ideals by iteratively enumerate 
the p-neighbors as follows. 

Algorithm 7.4 (S'-neighbors). Let O be an Eichler order of level in a quaternion 
algebra B of discriminant S, and let S be a nonempty finite set of prime ideals of *Lp 
coprime to QVl that generate Cl^^ 7Lp. This algorithm solves Problem (ClassSet). 

1. Solve (ClassNumber) as in Theorem EE] and let H = #ClO. 

2. Compute C\Zp and compute a set C of representatives of the set of ideals 
of If supported at S modulo principal ideals. 

3. Initialize 1 := 0, T := {0}, and Fncw '■= 0- 

4. For each I e J 7 , compute the primitive p-neighbors I' of / using Lemma 
17.21 for p € S. For each such determine if I' is isomorphic to any ideal 
in IUJ1, CW by an algorithm to solve (Islsomorphic); if not, add JI' to J- ncw 
for all J eC. 

5. Set X := X U J 7 , T := J- ncw and ^ncw := 0- If #1 = H , return X, otherwise 
return to Step 4. 

Proof of correctness. The algorithm enumerates all right invertible O-ideals with 
norm supported at S by the discussion preceding Lemma 17.21 and so will find all 
ideal classes by Proposition 17.31 □ 

Our algorithm was inspired by the implementation due to Kohel in the computer 
algebra system Magma 0] for definite quaternion algebras over Q. 

Remark 7.5. In Algorithm 17. 4i one can alternatively use the mass formula as in 
Remark 15.41 here, one trades the difficulty of computing the class number directly 
with computing the unit index [O* : 7L* F \ for each order O = Ol(I). To compute 
this unit index, we consult Vigneras [5S1 Theorem 6]. If all totally positive units 
of %p are squares, then the group Ol(I)* /%* f 1S j us * * ne se t 01 shortest vectors in 
Ol(I), i.e., the reduced norm 1 subgroup 0\ modulo {±1}, and this group can be 
computed by lattice enumeration. Otherwise, if the norm 1 subgroup is not cyclic, 
then O* fZ* F is at most an extension of OJ/{±l} of index 2 and we can explicitly 
write down candidates for this extension. If the norm 1 subgroup is cyclic, then we 
must fall back on a lattice search in O. 
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To analyze the running time of Algorithm 17. 4\ we now examine the distribu- 
tion of ideal classes among ideals following this enumerative strategy. Let S be a 
nonempty finite set of prime ideals of Zp coprime to J)0T (as in Algorithm I7.4|) . 
Let T(S) denote the set of primitive right invertible O-ideals whose reduced norm 
is supported in S. Then T(S) can be given the structure of a directed graph, where 
an edge exists from 7 to J if and only if J is a p-neighbor of 7 for some p E S. 
Note that by Lemma 17. 2\ the set of limit points of T(S) is naturally identified 
with Ilpes P 1 (^F,p) = Ilpes IP 1 (^"p ), and T(S) is fc-regular as an undirected graph, 
where k = U peS ( N P + 

The set of a 6 B* such that nrd(a) is supported in S acts on the graph T(S) by 
multiplication on the left, and the set of vertices of the quotient G(S) is a set of 
representatives for CIO by Proposition 17.31 In particular, G(S) is connected and 
fc-regular. When S — {p} consists of a single prime, we abbreviate G(S) by simply 
G(p). 

The graphs G(p) are known in many cases to be Ramanujan graphs, graphs whose 
eigenvalues other than ±fc have absolute value at most 2yfe— 1, and are therefore a 
type of expander graphs. In the simplest case where F = Q and S — {p}, they were 
studied by Lubotzky, Phillips, and Sarnak |35j and Margulis [36) : the nontrivial 
spectrum of G(p) can be identified with the spectrum of the Hecke operators acting 
on the space of cusp forms of weight 2 on ro(p), and the eigenvalue bound then 
follows from the Ramanujan-Petersson conjecture, a consequence of the Eichler- 
Shimura isomorphism and Dcligne's proof of the Weil conjectures. Charles, Goren, 
and Lauter [9] have shown that the same is true for graphs G(f) under the following 
set of hypotheses: F is a totally real field of narrow class number one, B = B p ®qF 
where B p is the quaternion algebra of discriminant p over Q and p is unramified 
in F, and [ is a prime ideal of 1p coprime to p. We note that there are further 
constructions due to Jordan and Livne [25] . The general result we will need is due 
to Livne [33], as follows. 

Theorem 7.6. Let S be a finite set of primes with p { dF^^t for all p € S. Then 
the nontrivial eigenvalues of G(S) are bounded by 2# s Yipes V^P- In particular, 
the graph G(p) is Ramanujan if p j dp^yi and Np > 4. 

Proof. See the proof of the Ramanujan-Petersson conjecture for Hilbert modular 
forms by Livne [34[ Theorem 0.1] for such primes p and the accompanying discus- 
sion. □ 

We now use the Ramanujan property (Theorem 17. 6[) of these graphs to estimate 
the run time of the S- neighbors algorithm (|7.4[) . For a prime p of Zp, let 



so that v(p) = O(Np) (as Np — > oo) and let v(S) = ]J pGS v(p). 

Proposition 7.7. Let S be a finite set of primes such that p \ dpDVi and Np > 4 
for all p G S . Then Algorithm 17.41 makes at most v(S)H 3+s calls to Problem 
(Islsomorphic), where 77 = #C1(C) and 

4l0g2 <13. 
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Proof. Each right ideal I € T in Step 3 of the S'-neighbors algorithm has at most 
IlpesNp neighbors, except for the trivial ideal class with J| peS (Np + l) neighbors. 
Therefore, the number of vertices with distance < D (with D € Z>o) from the 
starting vertex is at most 

JJ(Np + l) (l+JjNp + - 

pes y pes 

P W p } (np £S Np)-i -np £S (Np-i)ii p ■ 

Define the distance d(v,w) between two vertices v,w in the graph G = G(S) to 
be the length of the shortest path between them, and define the diameter of G to 
be D(G) = max v<w d(v,w). Chung [10] has proven that 




(7.8) D(G) < 



log(fc/A) 



where k = IIpes(Np + 1) is the regularity of the graph and by Theorem 17.61 we 
have the eigenvalue bound A < 2# s JlpeS \/Njj. It follows that 

J| Np D< - G) < TT N p log H l l°g(* A)+l = F E pes logNp/log(fe/A) -Q Np _ 

pes pes pes 

Since (x + l)/(2y/x) > \pxj2 for all x > 0, we have 

Epes 1 °g N P < SpeS lQ g N P < 2£ peS logNp 



log(fc/A) " £ peS log((Np + l)/(2%/Np)) " (E P es lo g N P) " 21o S 2 

41og2 „ r 

= 2 + -j— — s = 2 + S. 

(E P es 1 ogNp)-log4 

Putting these together, we find that Algorithm 17.41 has traversed the graph G(S) 
after visiting at most 



vertices. Since each of these must be checked for isomorphism against a set T of 
size j^T < H, we obtain the result. □ 

Before proving the definite case of Theorem B, we prove one further lemma. 

Lemma 7.9. There exists an algorithm which, given an ideal class [a] G C1s oo (Zf) 
and a finite set T of primes of If, computes in probabilistic polynomial time a 
prime p ^ T such that [p] = [a] and Np = 0(log 2 IlqeT ^ l) f or a fi xe d totally real 
field F. 

Proof. We use a (weak) version of the effective Chebotarev density theorem due to 
Lagarias and Odlyzko, applied to the strict Hilbert class field of F. For an ideal 
class [a] € Cls 00 (Zp), define the counting function 

K[ a }{ x ) = #{P C Z F prime : [p] = [a] and Np < s} 
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for x £ R>2- Then, by Lagarias and Odlyzko [30l Theorems 1.3-1.4], there exists 
an effectively computable constant xo > which depends only on F such that for 
all [a] £ C\s x (Zp) and all x > xq, we have 



(7.10) 



1 



ft \ogx 



< 



1 



2ft log x 



where h = # Cls^ Zp. (In fact, they prove a certainly stronger bound on the error 
and show that \ogxo — (dpn) ^, but this weak version suffices for our purposes.) 

We begin with two precomputation steps. We first compute the constant xq, 
the strict class group Clg^ Zp, and factor the discriminant cLf- Next, for each 
(rational) prime p < Zp with p < x, we factor pZp and see if there exists a prime 
p | p such that [p] = [a] and p ^ T. If so, we return the ideal p. If not, then for all 
primes p with [p] = [a] we have p £ T. 

Let N(T) = n qS T Nc l and let x = max(a;o,log 2 N(T), (4ft,) 4 ). Clearly x = 
0(log 2 N(T)). Then 

#T < N(T) < Vi < 



By (ffTTOjl . we have 



tt[o] (a;) - #T 



> 



1 



4ft log a? 



1 



1 



2ft log a; 4ft, log x 4ft log x 



We have that #{b € [a] : Nb < x} < cx for some constant c > 0. Therefore, by 
employing the algorithm of Lemma 16. Hi we can find in probabilistic polynomial 
time a prime ideal p with [p] = [a], Np < x, and p ^ T. □ 

We now prove the definite case of Theorem B. 

Theorem 7.11. There exists an algorithm to solve Problem (ClassSet) for definite 
orders with factored discriminant over a fixed field F which runs in probabilistic 
polynomial time in the output size. 

Proof. We use Algorithm l7.4l Wc must, for a given order O of discriminant = 2)0^, 
choose a set S of primes p of Zp which represents the elements of the narrow class 
group Cls x Z F such that p \ d F T>yi and Np > 5 for all p £ S. We do this by first 
computing a set of representatives for Clg^ Zp (which runs in constant time for 
fixed F) and then using the algorithm of Lemma [7.91 with T = {p : p | dpS)Dl}, 
which runs in probabilistic polynomial time in the size of the input. 

We now refer to the proof of Proposition 17.71 We claim that we may arrange 
so that the diameter D(G) of the S-neighbors graph G = G(S) is D(G) = 1. By 
it is sufficient to have 

Np- 



(7.12) 



H = #C\G < Yl 



1 



pes 



Thus, we may add primes to S if necessary of polynomial size so that (I7.12p holds. 

With the set S now computed, we employ Algorithm 17.41 Step 1 can be per- 
formed in probabilistic polynomial time over a fixed totally real field F and we 
have already performed Step 2. We conclude from Theorem 17.71 that Step 3 re- 
quires a number of calls to Problem (IsPrincipal) which is polynomial in the size of 
the output H = fj=CXO, each with input of polynomial size. In solving Problems 
(Islsomorphic) and consequently (IsPrincipal), we only need to check ideals with the 
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same reduced norm since D(G) = 1. By Proposition 16. 12\ each call to Algorithm 
16.31 runs in deterministic polynomial time, and the proof is complete. □ 

We conclude by proposing an alternative to Algorithm 17.41 which solves Problems 
12.21 (ClassSet) and !2.8l (ConiClassSet) simultaneously by computing two-sided ideals 
and connecting ideals, as in Proposition 12.101 This algorithm appears to perform 
better than Algorithm 17.41 in practice, though we do not prove anything rigorous 
along these lines. 

Algorithm 7.13. Let O be an Eichler order of level 9t. This algorithm outputs a 
set £ = {Oi} of representatives of the conjugacy classes of Eichler orders of level 
91, a set C — {Ci} of integral invertible right O-ideals such that Ol(Ci) = Oi, and 
a set X of representatives of CI O. 

1. Solve (ClassNumber) as in Theorem GDI and let H = #GlO. 

2. Initialize 6, C := {O}. Let X be a system of representatives for the two-sided 
O-ideal classes as in Proposition 13.31 

3. Choose Oi S £ and p an ideal of coprime to and compute the set 
J of primitive right O^-ideals with norm p as in Lemma 17.21 

4. For all I G J such that Ol(I) is not isomorphic to any order in £, ap- 
pend Ol(I) to £, and append {JICi}j to X where J ranges over a set of 
representatives for the two-sided Oi(/)-ideal classes. 

5. If #X = H, return £,C,X; otherwise, return to Step 3. 

Proof of correctness. The completeness of X follows from Proposition 12.101 once 
we show that the algorithm eventually enumerates all conjugacy classes of orders. 
Indeed, let O' be an Eichler order of level €Tt; then there exists an integral, invertible 
right O', O-ideal I. By Strong Approximation ( Proposition 17.31) . we may assume 
that nrd(J) is coprime to As in the proof of Lemma 13.21 / factors into a 

product I = • • • I r where each Ij is an invertible integral ideal of prime reduced 
norm with On(Ij) = O^Ij+i). The result now follows. □ 

Remark 7.14. In practice, the ability to choose prime ideals p of small norm in Step 
3 is essential to enumerate only a small number of ideals of norm p; for this reason, 
we find that it is usually faster to check different orders Oi than to compute with 
only one fixed order as in Algorithm 1 7. 41 Nevertheless, the primes p in Step 3 must 
be chosen in a way such that they generate the narrow class group of Zp. 

Moreover, if some of the orders Oi have more than one isomorphism class of 
two-sided ideals, they contribute to X accordingly, which speeds up the enumera- 
tion. In this case, the alternative evaluation of the mass formula fRemark !7.5[) also 
simplifies, since all right O-ideals with conjugate left orders have the same mass. 
On the other hand, if each Oi has only the trivial two-sided ideal class, a condition 
which is not obviously anticipated, then Algorithm 17. 131 may take somewhat longer 
than Algorithm [7H1 

8. Definite Eichler orders with class number at most two 

In this section, we list all definite Eichler orders O with h(0) < 2. From (|5.1[) 
and Proposition 15.31 for such an order we have 

2 > h(0) > M(0) > 2 1 -|Cf(-1)| > 7zl>4 /2 
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and hence 

(8.1) Sp = 4 7 " < ( 27r ) 4/3 < n - 594 - 

By the Odlyzko bounds, there are only finitely many such fields and they have 
been explicitly enumerated [48]: we have 1,39,47, 108,37,40,4,3 fields of degrees 
n = 1,2,3,4,5,6,7,8, respectively, and no field satisfying the bound (|8.1|> with 
n > 9, for a total of 279 fields. 

For each such field, using the methods of §5 (Proposition 15. 7|) we compute the 
mass Mi^Lp ,1p)\ then for an Eichler order of level 01 in a quaternion algebra of 
discriminant J) over F, we have 

M(£>,«tt) = A/(Z F ,Z F )$(£>)* (91) < 2 

which gives a finite list of possible ideals 55, 91. For each such possibility, we compute 
the corresponding class number using the Eichler mass formula as in Theorem l5.10l 
To check the computation, we also enumerate the ideal classes explicitly as in §6 
(using Algorithm 17.131 and the alternate mass formula, Remark 15. 4[) and see that 
in all cases they match. 

We consider two Eichler orders, specified by the ideals 23,91 of Z F and S3', 91' 
of Z F <, to be equivalent if there is an isomorphism a : F — > F' of fields such that 
er(£>) = 53' and ct(91) = 91'. Two equivalent Eichler orders have the same class 
number by the mass formula. 

Proposition 8.2. There are exactly 76 equivalence classes of definite Eichler orders 
with class number 1 and 217 with class number 2. 

These classes are listed in Tables HT3H8. 41 Here we list the degree n, the discrimi- 
nant dp of F, and the norms D and N of the discriminant 53 and level 91. This way 
of recording orders is compact but ambiguous; nevertheless, in all cases the field F 
is determined by its discriminant, and in all but a handful of cases, for any choice 
of squarefree 53 and coprime 91 an Eichler order of level 91 in a quaternion algebra 
of discriminant 53 has the given class number. For the handful of exceptions, we 
refer to the complete tables which are available online [28 . 

We note that the results in Table 18.31 for F = Q agree with those of Brzezihski 
[6] (when restricted to Eichler orders). 
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Table 18.31 Definite Eichler orders O with class number h(0) = 1 
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Table 18.41 Definite Eichler orders O with class number h(0) = 2 
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